@irsdl@thezdi@MDSecLabs Of course, I can do it with typeconflusedelegate, but generating resources with textformattingrunproperties cannot trigger the vulnerability (eg: resourceset). Your resourcesetgenerator also failed. Is there a problem with the resources generated by resourcesetgenerator?